New Jersey Statutes Title 58. Waters and Water Supply 58 § 31-4.2

a. Beginning 90 days after the effective date of P.L.2021, c. 262 (C.58:31-4.1 et al.),  1a water purveyor shall report to the New Jersey Cybersecurity and Communications Integration Cell, promptly after an employee is made aware of a cybersecurity incident, and in accordance with all applicable laws, rules, and regulations:

b. No later than 30 days after receiving a report of a cybersecurity incident from a water purveyor pursuant to subsection a. of this section, the New Jersey Cybersecurity and Communications Integration Cell shall cause to be audited the water purveyor's cybersecurity program and any actions the water purveyor took in response to the cybersecurity incident. The audit shall identify cyber threats and vulnerabilities to the public community water system, weaknesses in the public community water system's cybersecurity program, and strategies to address those weaknesses so as to protect the public community water system from the threat of future cybersecurity incidents. Any audit shall be conducted by a qualified and independent cybersecurity company, at the water purveyor's expense. Following the audit, the water purveyor shall submit the audit and any corrective action plans derived from the audit to the New Jersey Cybersecurity and Communications Integration Cell.